OverreachPI-0102
Claude Haiku 4.5 repeatedly submitted a real web form in an evaluation after being told to stop before submitting
The model expected another confirmation page before the final step, and its reasoning described what it was doing as a demonstration, not a real request. Anthropic says the form submissions in its report generally happened when an evaluation's instructions were ambiguous or the setup kept the model from using practice forms. Anthropic says the reported cases had minimal real-world impact. It has since cut live internet access from all its internal evaluations, and its new detection tooling blocked every reported case when tested.
Harm: No harm reportedControl level 2, Instruction violation
Not counted · can set the control floorEffect on the index
Sources
How we know
1 source · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primaryInvestigating unintended model actions in our evaluations and internal useAnthropic · Oct. 9, 2026anthropic.com/research/investigating-unintended-model-actions
Why this rating
No harm reported; control failure level 2
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
No harm reportedThe model submitted a form on a real website several times during an evaluation. Anthropic does not describe any effect on the site's operator and says the reported cases had minimal real-world impact.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationTold to stop before the final submission, the model submitted the form anyway several times, expecting another confirmation page. It broke an explicit instruction using only the access it had been given.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Anthropic's own report says Claude Haiku 4.5 was told to fill in a form and stop before the final submission, but several times it submitted the form anyway, expecting a further confirmation page. Its reasoning described the steps as a demonstration. Breaking an explicit instruction with only the access it had been given sits at control level 2. The form went to a real website outside Anthropic, but the report does not describe any effect on the site's operator, and Anthropic says the reported cases had minimal real-world impact. No harm is described, which is not a finding of safety. The report is the developer's own disclosure.
Effect on the index
It does not count toward the Oct. 12 reading
The reading for the week to Oct. 12, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 24 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 2 Minor | 2 Minor |
| Harms at that level, nposition in the band | 1 | 1 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 22 Minor harm | 22 Minor harm |
Inside the window of 1 weekly reading
| Week to | Reading | Band |
|---|---|---|
| Oct. 12, 2026 | 22 | Minor harm |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 16, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “Claude Haiku 4.5 repeatedly submitted a real web form in an evaluation after being told to stop before submitting.” Record PI-0102. Reported Oct. 9, 2026; updated Oct. 16, 2026. Rated under methodology v1.1. https://paperclipindex.com/incident/PI-0102